remcos

General

Target

b76c0ea7bdd5089aca7652a004754479_JaffaCakes118
Size

247KB
Sample

240822-ncqa6swhkq
MD5

b76c0ea7bdd5089aca7652a004754479
SHA1

fc4e425cf91db786915d7705bf97b7b0d63419d4
SHA256

d092a60d031f2dfa8d009742db3f7d78d34d817f9c6be57a7b21469203a48dc3
SHA512

4ff69a140deb2f628343842f2e476d48a1f718cfad0ba2839413879aa4ced4f7e0c89ec8079128accc96648475ae1f8ffdecc441f5b20538d8b8b578685c053c
SSDEEP

6144:LqjIwLurUOeYjEPYClvAo69bPI+4gIEtrt:WPLurdeTPFqLbPI+x/

Score

10^/10

Malware Config

Extracted

Family

remcos

Version

2.7.2 Pro

Botnet

RemoteHost

C2

103.89.88.238:4299

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
excel.exe
copy_folder
excel
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
excel
keylog_path
%AppData%
mouse_option
false
mutex
excel-8OHAVR
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
excel
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Targets

- Target
  
  b76c0ea7bdd5089aca7652a004754479_JaffaCakes118
- Size
  
  247KB
- MD5
  
  b76c0ea7bdd5089aca7652a004754479
- SHA1
  
  fc4e425cf91db786915d7705bf97b7b0d63419d4
- SHA256
  
  d092a60d031f2dfa8d009742db3f7d78d34d817f9c6be57a7b21469203a48dc3
- SHA512
  
  4ff69a140deb2f628343842f2e476d48a1f718cfad0ba2839413879aa4ced4f7e0c89ec8079128accc96648475ae1f8ffdecc441f5b20538d8b8b578685c053c
- SSDEEP
  
  6144:LqjIwLurUOeYjEPYClvAo69bPI+4gIEtrt:WPLurdeTPFqLbPI+x/
Score

10^/10

remcos remotehost discovery persistence rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1
  
  30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA256
  
  6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- SHA512
  
  f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP
  
  192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  lpjj72.dll
- Size
  
  13KB
- MD5
  
  6987daed90160a5a82054e0d44c9b0b9
- SHA1
  
  ce5f726c86bd45929af26efdf8d49a1616ebaedf
- SHA256
  
  adb267f1f2c6f581419ad61ded004bf9a0d67466be479172f120a97dc33e6f5c
- SHA512
  
  0da50c533f392b1deb1ee21b0b28c6fe2ffead94d97ca565bf3bb404e591b5fde9d1466b881aa708adb68e0a03e42943a4c8920e7bd364f7c9e52116e8041d15
- SSDEEP
  
  192:3jb/V6ig35KKeFLICeHDrNoP9qli8YaCmNVOFDJo0MwPG2ngCNJ/fd:n/UXKKWLfeja9UwmN0l+mgG
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
behavioral5 behavioral6